Cicada
AD box on HTB.
Enumeration:
Port Scanning:
We will start with nmap scanning:
So this is an active directory domain controller.
Lets get the domain and the hostname of the target domain controller:
Add it to the hosts file:
Also I will sync the time with the target machine if we needed to interact with kerberos nearly:
We can view the available shares with guest session:
We can see that we have read permissions on the hr share.
Using impacket-smbclient we can enumerate that share to find what files it contains:
Only one file that is note from hr team:
We have a default password, we can dump the users with --rid-brute option of netexec:
Get the usernames only:
I will use kerbrute to perform password spraying:
And we still have one user with the default password.
BloodHound:
Collect the domain data with bloodhound-python:
Start bloodhound, and upload the data we collected to it:
I did not find anything useful as michael.wrightson, but we can find that if we compromised emily.oscars that is part of Backup Operators group, we can backup the sam database, and the system hive registry:
Lateral Movement to david.orelious:
I will try to get the users descriptions, because sometimes it contains some sensitive data, like user's password:
So we will have another credentials.
Privilege Escalation:
Backup Operators:
Lets go back to the shares again, because there was one share that we did not have access to it:
Now we have read permissions on the dev share as david.orelious, lets authenticate to that share and check if there was any interesting data:
We will find out a backup script that contains plain-text password for emily.oscars user:
As shown in bloodhound enumeration we did that emily.oscars is member of Remote Management Users and Backup Operators groups, which allows us to authenticate via WinRM, and backup the sam and system hive registries:
Then we can download both of them using the download functionality of evil-winrm:
Now we can dump sam data with impacket-secretsdump:
If we checked the administrator hash with netexec:
We will find that the local administrator has the same hash as the domain admin administrator.
So we can authenticate via WinRM for example:
And we can get the flags:
Last updated